Honest claims & reporting

The canonical list of what damn.dev never claims, the line between sovereignty and containment, and how to report a security issue.

This is the guard-rail page. Everything else in the docs is held to it.

What we never claim#

  • That the standard install is "fully contained." Containment of the standard install is platform-dependent and we state the per-platform ceiling honestly. Full containment is available as an enterprise capability — we're clear about which tier you're on.
  • "Kernel-contained" or "egress-blocked" on install paths where the OS sandbox isn't engaged. Containment is platform-dependent; where it isn't kernel-enforced we say so, and the enterprise tier delivers full containment identically everywhere.
  • That damn.dev contains, observes, or controls an AI worker it doesn't run. For external workers we record what's declared or observed — never enforced.
  • That a cooperative gate is containment. The coding and MCP gates are best-effort, fail-open, and bypassable — they govern a cooperating agent on a tamper-evident record, not a cage.
  • "Billing-grade" cost. AI usage cost is estimated, with bounded coverage and best-effort attribution.
  • That audit integrity protects the host. Tampering is detectable; the log doesn't make a host with full access immune.

Sovereignty vs. containment#

The one distinction to keep straight:

  • Sovereignty — your data never leaves your perimeter — is architectural and always true, on every platform and install path.
  • Containment — physically stopping an agent from reaching something — is platform-dependent on the standard install, and we name the ceiling every time (see Shell execution). The enterprise tier closes it with allow-listed egress, scoped credentials, and disposable execution.

Enforced vs. trusted, in one line#

damn.dev enforces the boundaries between members and between workspaces, gates consequential actions, and keeps a tamper-evident record. It trusts the host machine, the agent runtime's mounts, operators, and (for self-hosted installs) network transport. Neither half is hidden — see Enforced vs Trusted.

Reporting a security issue#

Found something? Email [email protected] with the details and steps to reproduce. As the deployer you also own the operational duties that keep your instance safe — chiefly backing up secrets.key off the host, and securing transport on local and desktop installs.

Next#

Previous← Isolation, auth & secrets